GCVE - cpe:2.3:a:jenkins:liquibase_runner:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:liquibase_runner:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Liquibase Runner (`1ddb4e47-a951-5671-84c4-b6091a16726e`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-2285`	vulnerable	2026-06-08 05:24:59.223982	Details available A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Published: 2020-09-23T13:10:20.000Z Updated: 2024-08-04T07:01:41.284Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2030 http://www.openwall.com/lists/oss-security/2020/09/23/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2284`	vulnerable	2026-06-08 05:24:59.223437	Details available Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Published: 2020-09-23T13:10:20.000Z Updated: 2024-08-04T07:01:41.366Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1887 http://www.openwall.com/lists/oss-security/2020/09/23/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2283`	vulnerable	2026-06-08 05:24:59.222945	Details available Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control changeset files evaluated by the plugin. Published: 2020-09-23T13:10:19.000Z Updated: 2024-08-04T07:01:41.417Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1885 http://www.openwall.com/lists/oss-security/2020/09/23/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000146`	vulnerable	2026-06-08 05:10:25.532075	Details available An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM. Published: 2018-04-05T13:00:00.000Z Updated: 2024-09-16T19:31:43.986Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2018-03-26/#SECURITY-519	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.